--- title: Iranian Government-Sponsored APT Cyber Actors description: Learn about Iranian government-sponsored APT cyber actors and their tactics. Stay informed on the latest threats and how to protect your systems. image: https://blog.voiceplus.com.au/hubfs/ACSC.png --- [![header-logo-img](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/logo_header.png)](https://www.voiceplus.com.au/) - [Home](https://www.voiceplus.com.au/) - Solutions ENTERPRISE SERVICES [Integrated Managed Mobility & EndPoint Services](https://www.voiceplus.com.au/enterprise-services/integrated-managed-mobility-and-endpoint-services) [Telecom Expense Management & Optimisation](https://www.voiceplus.com.au/enterprise-services/telecom-expense-management-and-optimisation) [Device Lifecycle Management](https://www.voiceplus.com.au/enterprise-services/device-lifecycle-management) [Procurement & Support](https://www.voiceplus.com.au/enterprise-services/procurement-and-support) [Device Security & Application](https://www.voiceplus.com.au/enterprise-services/device-security-and-application) [Site, Branch & Site Connectivity](https://www.voiceplus.com.au/enterprise-services/site-branch-and-site-connectivity) ENTERPRISE OUTCOMES [Reduce Costs](https://www.voiceplus.com.au/solutions/reduce-costs) [Track Assets & Centralized Management](https://www.voiceplus.com.au/solutions/track-assets-and-centralized-management) [Security](https://www.voiceplus.com.au/solutions/security) - [About Us](https://www.voiceplus.com.au/about-us) - [Contact Us](https://www.voiceplus.com.au/contact-us) - [Blog](https://blog.voiceplus.com.au/en-au) - [Trust Centre](https://www.voiceplus.com.au/trust-centre) # Iranian Government-Sponsored APT Cyber Actors ![underline-img](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/underline.png?width=212&height=3&name=underline.png) 23 November 2021 [![Share on linkedin](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/linkedin-color.png?width=24&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.voiceplus.com.au/en-au/iranian-government-sponsored-apt-cyber-actors?utm_medium=social&utm_source=linkedin) [![Share on twitter](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/twitter-color.png?width=24&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://blog.voiceplus.com.au/en-au/iranian-government-sponsored-apt-cyber-actors?utm_medium=social&utm_source=twitter&url=https://blog.voiceplus.com.au/en-au/iranian-government-sponsored-apt-cyber-actors?utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/facebook-color.png?width=24&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://blog.voiceplus.com.au/en-au/iranian-government-sponsored-apt-cyber-actors?utm_medium=social&utm_source=facebook) FBI and CISA have observed an Iranian government-sponsored APT group that are exploiting vulnerabilities to gain access to systems. The APT group has exploited the same Microsoft Exchange vulnerability in Australia. **Alert status: CRITICAL** ## Background / What has happened? The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have observed an Iranian government-sponsored advanced persistent threat (APT) group exploit Fortinet vulnerabilities since at least March 2021, and a Microsoft Exchange ProxyShell vulnerability since at least October 2021 to gain access to systems in advance of follow-on operations, which include deploying ransomware. ACSC is also aware this APT group has used the same Microsoft Exchange vulnerability in Australia. The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations. FBI, CISA, and ACSC assess the actors are focused on exploiting known vulnerabilities rather than targeting specific sectors. These Iranian government-sponsored APT actors can leverage this access for follow-on operations, such as data exfiltration or encryption, ransomware, and extortion. ## Mitigation / How do I stay secure? The FBI, CISA, ACSC, and NCSC have published an [advisory](https://www.cyber.gov.au/about-us/advisories/iranian-government-sponsored-apt-cyber-actors-exploiting-microsoft-exchange-and-fortinet-vulnerabilities-furtherance-malicious-activities) that provides observed tactics and techniques, as well as indicators of compromise (IOCs). The FBI, CISA, ACSC, and NCSC urge critical infrastructure organizations to apply the recommendations listed in the Mitigations section of the [advisory](https://www.cyber.gov.au/about-us/advisories/iranian-government-sponsored-apt-cyber-actors-exploiting-microsoft-exchange-and-fortinet-vulnerabilities-furtherance-malicious-activities) to mitigate risk of compromise from Iranian government-sponsored cyber actors. ## Assistance / Where can I go for help? ACSC can provide tailored cyber security advice and assistance, reporting, and incident response support at via [1300 292 371](tel:1300%20292%20371) (1300 CYBER1). ## Latest from the Blog [![blog-featured](https://blog.voiceplus.com.au/hs-fs/hubfs/featured-market-update.png?width=226&height=226&name=featured-market-update.png)](https://blog.voiceplus.com.au/en-au/satellite-to-mobile-in-australia-market-and-regulatory-update-august-2026) [Satellite-to-Mobile in Australia: Market and Regulatory Update — August 2026 ![arrow](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/arrownext.png?width=27&height=12&name=arrownext.png)](https://blog.voiceplus.com.au/en-au/satellite-to-mobile-in-australia-market-and-regulatory-update-august-2026) [![blog-featured](https://blog.voiceplus.com.au/hs-fs/hubfs/featured-starlink-voice.png?width=226&height=226&name=featured-starlink-voice.png)](https://blog.voiceplus.com.au/en-au/starlink-voice-in-australia-what-s-actually-available-today-and-what-s-coming) [Starlink Voice in Australia: What's Actually Available Today (and What's Coming) ![arrow](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/arrownext.png?width=27&height=12&name=arrownext.png)](https://blog.voiceplus.com.au/en-au/starlink-voice-in-australia-what-s-actually-available-today-and-what-s-coming) [![blog-featured](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus%20One%20Platform.png?width=226&height=226&name=VoicePlus%20One%20Platform.png)](https://blog.voiceplus.com.au/en-au/one-platform-every-endpoint-atrium-intune-laptop-management) [VoicePlus Atrium — one platform managing mobiles, laptops, lifecycle, and Intune security under one roof ![arrow](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/arrownext.png?width=27&height=12&name=arrownext.png)](https://blog.voiceplus.com.au/en-au/one-platform-every-endpoint-atrium-intune-laptop-management) [![blog-featured](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus%20Enterprise%20Governance1.png?width=226&height=226&name=VoicePlus%20Enterprise%20Governance1.png)](https://blog.voiceplus.com.au/en-au/enterprise-mobility-governance-what-it-looks-like) [What Enterprise-Grade Mobility Governance Actually Looks Like ![arrow](https://blog.voiceplus.com.au/hs-fs/hubfs/VoicePlus_2023_blog_assets/arrownext.png?width=27&height=12&name=arrownext.png)](https://blog.voiceplus.com.au/en-au/enterprise-mobility-governance-what-it-looks-like) 3 Strategies to Reduce Telecom Cost [Here's How](https://landing.voiceplus.com.au/en-au/3-strategies-to-reduce-telecom-cost) ![footer-logoimg](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/footerlogo.png) VoicePlus is your independent managed mobility and endpoint specialist. We combine our experience and technology to secure cost savings and optimise productivity for clients seeking better business outcomes. The VoicePlus Companies acknowledges the Traditional owners of the lands on which we meet and work, both at our offices on Cammeraygal land and our locations across Australia. We pay our respects to Elders’ past, present and emerging and honour their living culture and custodianship. Solutions [Integrated Managed Mobility](https://www.voiceplus.com.au/services/managed-mobile-computer-services) [Telecom Expense Management](https://www.voiceplus.com.au/services/telecom-expense-management) [Device Lifecycle Management](https://www.voiceplus.com.au/services/device-lifecycle-management) [Procurement & Support](https://www.voiceplus.com.au/services/procurement-and-support) [Device Security & Application](https://www.voiceplus.com.au/services/device-security) [Site, Branch & Site Connectivity](https://www.voiceplus.com.au/services/managed-endpoint) ![seperator-img](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/seperator.png) [Reduce Cost](https://www.voiceplus.com.au/enterprise-outcomes/cost-optimisation) [Track Assets](https://www.voiceplus.com.au/enterprise-outcomes/cost-visibility) [Security](https://www.voiceplus.com.au/services/device-security) VoicePlus [Privacy Policy](https://www.voiceplus.com.au/policies/privacy-policy) [Modern Slavery](https://www.voiceplus.com.au/policies/modern-slavery-statement) [Contact Us](https://www.voiceplus.com.au/contact-us) [About Us](https://www.voiceplus.com.au/about-us) [Trust Centre](https://www.voiceplus.com.au/trust-centre) Find Us [+61 2 9334 5600](tel:+61%202%209334%205600) [customercare@voiceplus.com.au](mailto:customercare@voiceplus.com.au) [VoicePlus Head Office Suite 902, 275 Alfred Street North Sydney, NSW 2060 Australia](https://goo.gl/maps/kaky2AuyRWgHJicT9) [VoicePlus Branch Office Suite A, Floor 8, 152 Quay Street Auckland, AUK 1010 New Zealand](https://maps.app.goo.gl/78fGwdLFHfXHNN4h9) [![twitter-img](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/twitter.png)](https://x.com/VoicePlusData1) [![linkedin-img](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/linkedin.png)](https://www.linkedin.com/company/voiceplus-data) [![fb-img](https://blog.voiceplus.com.au/hubfs/VoicePlus_2023_blog_assets/fb.png)](https://www.facebook.com/VoicePlusData) ![VoicePlus is ISO/IEC 27001:2022 Certified](https://www.voiceplus.com.au/assets/footer-photos/ISO-Certified-1.png "VoicePlus is ISO/IEC 27001:2022 Certified") ![VoicePlus is ISO/IEC 27001:2022 Certified](https://www.voiceplus.com.au/assets/footer-photos/jas-anz-logo.gif "VoicePlus is ISO/IEC 27001:2022 Certified") --- Copyright © 2026. All Rights Reserved ![](https://blog.voiceplus.com.au/hubfs/raw_assets/public/Custom/page/VoicePlus_blog_2023_theme/icons8-settings-32.png) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Australian Cyber Security Centre", "url" : "https://blog.voiceplus.com.au/en-au/author/australian-cyber-security-centre" }, "dateModified" : "2024-09-11T11:00:23.890Z", "datePublished" : "2021-11-22T21:32:32.000Z", "headline" : "Iranian Government-Sponsored APT Cyber Actors", "image" : [ "https://blog.voiceplus.com.au/hubfs/ACSC.png" ], "mainEntityOfPage" : { "@id" : "https://blog.voiceplus.com.au/en-au/iranian-government-sponsored-apt-cyber-actors", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.voiceplus.com.au/hubfs/voiceplus_logo.png" }, "name" : "VoicePlus" } } ```